[ 16.412298] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.725056] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 22.161778] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 22.968226] random: sshd: uninitialized urandom read (32 bytes read, 94 bits of entropy available) [ 23.140807] random: sshd: uninitialized urandom read (32 bytes read, 100 bits of entropy available) Warning: Permanently added '10.128.15.203' (ECDSA) to the list of known hosts. [ 28.549199] random: sshd: uninitialized urandom read (32 bytes read, 109 bits of entropy available) executing program executing program executing program executing program executing program [ 28.673588] ================================================================== [ 28.680985] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 [ 28.687969] Read of size 8 at addr ffff8801d0e904c0 by task syzkaller403495/3315 [ 28.695465] [ 28.697066] CPU: 0 PID: 3315 Comm: syzkaller403495 Not tainted 4.4.111-g3301b55 #17 [ 28.704822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.714140] 0000000000000000 9a394161b932e6ca ffff8801d08cf970 ffffffff81d0509d [ 28.722083] ffffea000743a400 ffff8801d0e904c0 0000000000000000 ffff8801d0e904c0 [ 28.730031] ffff8801d0b68238 ffff8801d08cf9a8 ffffffff814fd433 ffff8801d0e904c0 [ 28.737976] Call Trace: [ 28.740533] [] dump_stack+0xc1/0x124 [ 28.745862] [] print_address_description+0x73/0x260 [ 28.752489] [] kasan_report+0x285/0x370 [ 28.758079] [] ? sg_remove_request+0xf9/0x110 [ 28.764189] [] __asan_report_load8_noabort+0x14/0x20 [ 28.771006] [] sg_remove_request+0xf9/0x110 [ 28.776944] [] sg_finish_rem_req+0x295/0x340 [ 28.782968] [] sg_read+0xa21/0x1490 [ 28.788732] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 28.796932] [] ? fsnotify+0xee0/0xee0 [ 28.802350] [] ? avc_policy_seqno+0x9/0x20 [ 28.808203] [] do_loop_readv_writev+0x141/0x1e0 [ 28.814490] [] ? security_file_permission+0x89/0x1e0 [ 28.821212] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 28.827844] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 28.834480] [] compat_do_readv_writev+0x5df/0x6e0 [ 28.840938] [] ? vfs_writev+0xb0/0xb0 [ 28.846354] [] ? __fget+0x232/0x3b0 [ 28.851596] [] ? __fget+0x47/0x3b0 [ 28.856750] [] compat_readv+0xd9/0x140 [ 28.862249] [] compat_SyS_readv+0xd8/0x1b0 [ 28.868095] [] ? SyS_pwritev+0x230/0x230 [ 28.873771] [] ? do_fast_syscall_32+0xd7/0x890 [ 28.879966] [] ? SyS_pwritev+0x230/0x230 [ 28.885639] [] do_fast_syscall_32+0x314/0x890 [ 28.891749] [] sysenter_flags_fixed+0xd/0x17 [ 28.897768] [ 28.899363] Allocated by task 0: [ 28.902688] (stack is not available) [ 28.906363] [ 28.907955] Freed by task 0: [ 28.910933] (stack is not available) [ 28.914606] [ 28.916199] The buggy address belongs to the object at ffff8801d0e90480 [ 28.916199] which belongs to the cache fasync_cache of size 96 [ 28.928819] The buggy address is located 64 bytes inside of [ 28.928819] 96-byte region [ffff8801d0e90480, ffff8801d0e904e0) [ 28.940496] The buggy address belongs to the page: [ 30.366452] PANIC: double fault, error_code: 0x0 [ 30.371238] CPU: 0 PID: 3315 Comm: syzkaller403495 Not tainted 4.4.111-g3301b55 #17 [ 30.379000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.388321] task: ffff8801d154df00 task.stack: ffff8801d08c8000 [ 30.394342] RIP: 0010:[] [] dump_page_badflags+0x8/0x250 [ 30.403709] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 30.409990] RAX: ffff8801d154df00 RBX: ffffea000743a400 RCX: ffffffff8148f980 [ 30.417226] RDX: 0000000000000000 RSI: ffffffff838a83a0 RDI: ffffea000743a400 [ 30.424463] RBP: ffff880100000010 R08: 0000000000000001 R09: 0000000000000000 [ 30.431698] R10: 0000000000000002 R11: fffffbfff0ad781e R12: 0000000000000000 [ 30.438936] R13: ffffffff838a83a0 R14: 0000000000000000 R15: 0000000000000000 [ 30.446172] FS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f7774b40 [ 30.454363] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 30.460390] CR2: ffff8800fffffff8 CR3: 00000001d0938000 CR4: 0000000000160670 [ 30.467627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.474862] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.482097] Stack: [ 30.484207] [ 30.485797] Call Trace: [ 30.488346] [ 30.490373] Code: 00 e9 83 fd ff ff e8 a8 e2 06 00 e9 50 fd ff ff e8 9e e2 06 00 e9 1d fd ff ff 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 08 e8 61 06 [ 30.517054] Kernel panic - not syncing: Machine halted. [ 30.522385] CPU: 0 PID: 3315 Comm: syzkaller403495 Not tainted 4.4.111-g3301b55 #17 [ 30.530141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.539460] 0000000000000000 9a394161b932e6ca ffff8801db20ce38 ffffffff81d0509d [ 30.547413] ffffffff838367c0 ffff8801db20cf10 ffffffff83808040 ffff880100000000 [ 30.555358] 0000000000000000 ffff8801db20cf00 ffffffff81419a3a 0000000041b58ab3 [ 30.563298] Call Trace: [ 30.565846] <#DF> [] dump_stack+0xc1/0x124 [ 30.571910] [] panic+0x1aa/0x388 [ 30.576893] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 30.583785] [] ? vprintk_emit+0x242/0x850 [ 30.589549] [] ? dump_page_badflags+0x1d/0x250 [ 30.595746] [] ? vprintk_emit+0x242/0x850 [ 30.601510] [] df_debug+0x2d/0x30 [ 30.606579] [] do_double_fault+0x10b/0x210 [ 30.612432] [] double_fault+0x2d/0x40 [ 30.617850] [] ? dump_page_badflags+0x180/0x250 [ 30.624147] [] ? dump_page_badflags+0x8/0x250 [ 30.630256] <> [ 30.633327] Dumping ftrace buffer: [ 30.637178] (ftrace buffer empty) [ 30.640855] Kernel Offset: disabled [ 30.644460] Rebooting in 86400 seconds..